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29 locations shown as one incident took place in two states. 


Between January and December 2017, 28 incidents of mass attacks, during which three or more persons were 
harmed, were carried out in public places within the United States (see map for locations). These acts violated the 
safety of the places we work, learn, shop, relax, and otherwise conduct our day-to-day lives.'! The resulting loss of 
147 lives and injury to nearly 700 others had a devastating impact on our nation as a whole.* As the uncertainty 
they caused continues to ripple through our communities, those charged with ensuring public safety strive to identify 
methods to prevent these types of attacks. To aid in these efforts, the U.S. Secret Service National Threat 
Assessment Center (NTAC) examined these 28 incidents, to identify key themes for enhancing threat assessment 
and investigative practices. Regardless of whether these attacks were acts of workplace violence, domestic 
violence, school-based violence, or terrorism, similar themes were observed in the backgrounds of the 
perpetrators’, including: 


* Nearly half were motivated by a personal grievance related to a workplace, domestic, or other issue. 

* Over half had histories of criminal charges, mental health symptoms, and/or illicit substance use or abuse. 

* All had at least one significant stressor within the last five years, and over half had indications of financial 
instability in that timeframe. 


* Over three-quarters made concerning communications and/or elicited concern from others prior to carrying 
out their attacks. On average, those who did elicit concern caused more harm than those who did not. 


These findings, and others in this report, support existing best practices that the U.S. Secret Service has established 
in the field of threat assessment. They highlight the importance of gathering information on a person’s background, 
behaviors, and situational factors; corroborating the information from multiple sources; assessing the risk the 
individual poses for violence; and identifying intervention points to mitigate that risk.* 
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INCIDENT OVERVIEW 


THE PUBLIC SITES: The 28 incidents were carried out at 31 Figure 1. 
different sites, with nearly half (46%) at businesses (e.g., a bank, 





retailers, a law office, warehouses). Those that took place in ea URUCSIEES 
open spaces represented nearly a third (82%) and included such Businesses 
locales as public sidewalks, a large outdoor event, attractions, Open Spaces 
and communal areas. Four attacks (14%) were carried out at Schools 


educational institutions including two elementary schools, one Transportation 
high school, and one university. The remaining incidents took 
place on commuter trains, at an airport, and at churches (see 
Figure 1). 


Churches 





THE WEAPONS: Though most of the attacks were carried out Figure 2. 
using a firearm (n = 23, 82%), vehicles (n = 3; 11%) and knives 
(n = 2; 7%) were also used. Given the preliminary information on 
the attackers, of the 23 who used firearms, at least 10 possessed 
their weapons illegally at the time of the incident. Two of those 
ten were minors, and the others were either felons, had a 
protective order against them, or had some other factor that 
should have prohibited them from owning a firearm.° 


THE TIMING: The attacks took place throughout the year and 
occurred on every day of the week. Over half (n = 17, 61%) took No. of Attacks 6:59 AM 
place between the hours of 7:00 a.m. and 3:00 p.m. For half 

(n= 14, 50%), the violence ended within 5 minutes from when _ Figure 3. 


the first shot was fired or first person was harmed (see Figure 2 
and Figure 3). Duration of the Attacks 





END OF THE ATTACKS: In over half of the incidents, the attackers 
ended the violence by either departing the scenes on their own 
(n =10, 36%) or committing suicide at the scene (n =7, 25%). 
For the remaining attacks, the violence ceased as a result of 
actions taken by law enforcement (n=5, 18%) or bystanders 
(n=2, 7%), with a few ending when the firearm or vehicle 
became inoperable (n = 4, 14%). 


THE RESOLUTION: Eight attackers (29%) committed suicide as 
part of the incident or soon after departing the scene. Others 
were taken into custody at or near the scene (n =9, 32%), or 
apprehended at another location (n =7, 25%). The remaining 
four were killed by law enforcement (n = 4, 14%). 
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THE ATTACKERS 


GENDER AND AGE: All of the attackers were male. They ranged from Figure 4. 
a 15-year-old high school student to a 66-year-old retiree, with an 
average age of 37 years old. Though there may be a perception that 
mass attackers tend to be within a certain age range, for example, 
much older or much younger, we found almost equal distributions 
within major age groups (see Figure 4). 








Ages of the Attackers 


SUBSTANCE USE: About half of the attackers (n = 15, 54%) had a 
history of illicit drug use and/or substance abuse. This abuse, which 
included alcohol and marijuana, was evidenced by such factors as 
the attacker receiving treatment for the abuse, suffering legal 
consequences, or having significant problems in their personal lives 
stemming from the abuse. 





CRIMINAL CHARGES AND DOMESTIC VIOLENCE: Most of the attackers  FODNE &. 


(n = 20, 71%) had histories of criminal charges beyond minor traffic Mental Health Symptoms 


violations. Those charges included both non-violent (n = 16,57%) | peyehotic Symptoms = 
and violent (n = 15, 54%) offenses. Further, seven of the violent | paranoia tsti(‘«sé~*SSCd 
offenders had charges related to domestic violence.® In addition to | Hallucinations = stst=<CS«~dC SS 
the seven, two others were the subject of domestic disturbance calls 
during which no charges were filed. With that, we found that one — 

; ; ; Suicidal Thoughts | 6 | 
third of the attackers (n = 9) had histories related to domestic 


MENTAL HEALTH: Nearly two-thirds of the attackers (n = 18, 64%) experienced mental health symptoms prior to 
their attacks. The most common symptoms observed were related to psychosis (e.g., paranoia, hallucinations, or 
delusions) and suicidal thoughts (see Table 1). Further, some attackers (n = 7, 25%) had been hospitalized for 
treatment or prescribed psychiatric medications prior to their attacks. 





violence. 


Those Who Plotted to or Attacked Our Schools 


On April 10, the 53-year-old husband of a special education teacher entered his estranged wife’s classroom at an elementary 
school and fired ten shots, killing his wife and an 8-year-old student. He also injured a 9-year-old student before killing 
himself. 


On May 1, a 21-year-old student fatally stabbed one student and injured three others on a university campus. After his arrest, 
he claimed to be experiencing auditory hallucinations. 


On August 28, a 16-year-old gunman, who had planned to attack his school after being suspended, opened fire at the public 
library instead, fatally shooting two and injuring four. After his arrest, he claimed he was upset that he was not liked at school 
and was generally angry. 


On September 13, a 15-year-old gunman killed one student and injured three others at a high school from which he had been 
suspended over concerning notes he gave friends. After his arrest, he claimed his attack was to teach others a lesson about 
the consequences of bullying. 


On November 14, after killing his wife the previous day, a 43-year-old gunman shot his neighbors, then fired at random 
persons on his way to an elementary school, possibly in search of his neighbor’s son. While the school was on lockdown, the 
gunman fired shots that penetrated the outer walls injuring some. The attacker was ultimately killed by law enforcement. 
All told, he shot and wounded at least 10 and killed five, including two of his neighbors and his wife. 


Though not analyzed as part of this report due to the number of those harmed, on December 7, a 21-year-old former student, 
who had dropped out twice, entered his former high school and killed two students then himself. He may have been suicidal. 
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MOTIVES & TARGETING 


Motives: The perpetrators had a range of motives for carrying out their mass attacks. In almost half of the incidents 
(n = 13, 46%), personal grievances appeared to be the main motivating factor. In these cases, the attackers were 
retaliating for perceived wrongs related to their workplaces Table 2. 

(n =6), domestic situations (n = 5), or being bullied or disliked 
by classmates (n =2). One of the attackers retaliating for a 
workplace grievance also hoped to gain fame or notoriety for | Grevances 
his attack (see Table 2). Beyond personal grievances, other Workplace 
motives were related to ideological (n = 1) or racially-based 
(n = 5) beliefs; influenced by mental health symptoms (n = 4) 
such as hallucinations, paranoia, or delusions; and fanatical Personal 

political views (n=1). Additionally, three attackers made Ideological or racially-based 
statements or engaged in behaviors indicating that they did not 
intend to survive their attacks. Of these three, one committed 
Suicide at the scene, another was killed by law enforcement 
responding to the attack, and the third was taken into police Fame 
custody. 








Components to Motive n Percent* 


Domestic 


Mental Health / Psychosis 


Unknown 

BELIEFS: Though ideologies and racial biases played arole in  * Percentages exceed 100 as one case had two motives. 
the specific motives for some of the attackers, a total of seven 

(25%) appeared to have subscribed to a particular belief system, including one who strongly believed in government 
conspiracies, and equal numbers of those who supported white supremacy (n = 2) or radical black nationalism 
(Nn =2), aS well as those who were self-radicalized followers of ISIS (n =2). Of note, histories of hallucinations, 
paranoia, and/or delusions were also present for five of these seven attackers, and for two of them, their particular 
psychosis played a dominant role in the adoption of their belief systems. 





FIXATIONS: More than one-third (n=11, 39%) of the attackers exhibited a fixation, defined as an intense or 
obsessive preoccupation with a person, activity, or belief to the point that it impacted many aspects of their lives. 
For some, their fixation was evidenced by seeking out or consuming a significant volume of information regarding 
the object of their fixation. Attackers’ fixations often carried an angry or emotional undertone and revolved around 
several themes, including personal vendettas, romantic conflicts, personal failures, perceived injustices, delusions, 
sociopolitical ideologies, or other incidents of mass violence. 


TARGETING: Over half of the attacks (n = 16, 57%) resulted in harm to only random persons. A few (n=4, 14%) 
resulted in harm to pre-selected individuals known to the attacker, such as a co-worker or supervisor, while slightly 
more (n=6, 21%) resulted in harm to both random and specific individuals. When examining the nature of the 
targeting and the attackers’ motives, we found that: 


* All four of the attacks that resulted in harm to only pre-selected individuals, and no random individuals, were 
motivated by workplace grievances. 


* All five of the attacks motivated by domestic issues resulted in harm to at least one random person, outside of 
the person(s) targeted. 


* All four attackers whose motive was influenced by their psychotic symptoms inflicted harm on random persons. 
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KEY INVESTIGATIVE THEMES 


SIGNIFICANT STRESSORS WITHIN FIVE YEARS: All of the attackers had at least one significant stressor occur in their 
lives in the five years leading up to the attack. For some, this was in addition to any legal consequences they may 
have been dealing with related to the charges described above. These additional stressors most often related to: 





* Family/romantic relationships, such as spousal estrangements, divorces, romantic breakups, rejected 

proposals, physical or emotional abuse, or the death of a parent 

Personal issues, such as unstable living conditions, physical illnesses, or other significant disorders 

Work or school environments, such as being fired or suspended, filing grievances, being bullied at work or 

at school, feeling disrespected, or being the subject of real or perceived gossip 

* Contact with law enforcement that did not result in arrests or charges, such as being the subject of 
domestic disturbance calls or being sought for a crime unrelated to their attack 


* 
* 


Beyond these areas, we found that 
over half of the attackers (n=16, 
5/%) experienced stressors related to 
financial instability in the five-year 
period prior to their attacks. These 
financial stressors included an inability 
to maintain employment; living in 
homeless shelters; failed business 
ventures; and civil court filings and 
proceedings, such as_ judgments, 
evictions, tax warrants, and wage 
garnishments. For 10 of the attackers, 
these stressors occurred within one 
year of the attack. 





AGGRESSIVE NARCISSISM: Most of the attackers (n = 23, 82%) exhibited behaviors that were indicative of aggressive 
narcissism, aS evidenced by displays of rigidness, hostility, or extreme self-centeredness. For example, some 
inappropriately asserted control over others, as observed by their histories of domestic violence, sexual assault, 
harassment, or harming animals. Others had a history of violent or angry outbursts following interpersonal conflicts 
with co-workers, neighbors, or family members. Some attackers displayed an inflated sense of self or entitlement, 
unrealistically believing that they were deserving of certain relationships, successes, or benefits, with some reacting 
angrily when they did not obtain what they believed they deserved. 


COMMUNICATIONS: Most of the attackers (n = 22, 79%) had engaged in threatening or concerning communications. 
While half had threatened someone (n = 14, 50%), one-third threatened the target (n = 10, 36%) in some way prior 
to their attack. All 10 of the attackers in the latter group had a personal relationship to the target in that they were 
either co-workers, domestic partners, neighbors, or classmates. Though the presence of prior threats to the target 
is unusual for some forms of targeted violence (e.g., assassination), it is often seen in cases involving domestic or 
workplace violence, which together represent over a third of the mass attacks described in this report. 


CONCERNING COMMUNICATIONS: Outside of threatening communications, three-quarters of the attackers (n= 21, 
75%) engaged in other concerning communications that did not reach the threshold of a threat, such as making 
overly angry statements, racist comments, references to past attackers, suicidal language, or comments indicative 
of their intent to carry out an attack. In some cases, these communications caused alarm among those who 
observed them. 
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HISTORY OF ELICITING CONCERN: Most of the attackers (n = 22, 
79%) engaged in communications or exhibited behaviors that 
caused concern in others. Those who expressed concern 
included parents, siblings, current or former romantic partners, 
friends, neighbors, teachers, classmates, work associates, 
community members, and law enforcement. The responses to 
the behaviors varied amongst those who noted them. Some 
acted on their concerns by warning others about the person, 
filing complaints with employers or residential building 
managers, or deliberately avoiding the person altogether. 
Others expressed concern by notifying law enforcement, 
pursuing protective orders, or terminating the attacker's 


| Prior Communications 
bane truthof the. matter js when 
People-get fed up People get killed!” 





employment. Some of those concerned spoke to the person directly and urged them to seek help, offered help, or 
even secured psychological evaluations for them. For nearly half of the attackers (n = 13, 46%), those concerned 
feared for the safety of the individual or others around them. Of note, the attackers who had elicited concern in 
others had a higher average number of total casualties (M = 8) than attackers who had not elicited concern in others 


(M=4).7 


Table 3. 
General Backgrounds 


is Prercent 
‘Gender-MaleSSS~C~S~S~SCSi SSC 
rilicit drug use or substance abuse ——=«|—t8——=«:~=C 
[History of criminal charges) ——=S«dYS=C2O|SCTI 
History of domestic violence | |S 
Mental health symptoms —=SSS*~*~dSCSt:SCSC*dCt«éi 
Overall history of violence «SB 


Investigative Themes 


i Percent 
‘Fiation SS~=<“C~*~‘“—*~*~é~SCSaSCSdS(Ct 
‘stessorsSSSS™*~=~<CS~“<~*~*~sSCBSC*SCO 
Aggressively self-centered nature «| 23—=| «aa 
Threatening or concerning communications | 22 | 79% 
Blicited concen SS*~=~C=i SCO 
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THE INCIDENTS 


1) 


2) 


10) 


11) 


12) 


13) 


14) 


On January 6, a gunman fatally shot five and injured six at 
Fort Lauderdale-Hollywood International Airport, FL. 


On January 29, a gunman fatally shot three in a restaurant 
in Bowie, MD. 


On February 22, a gunman fatally shot one and injured two 
in a bar in Olathe, KS. 


On March 22, a gunman fatally shot two at a bank In 
Rothschild, WI. He then fatally shot another at a law office 
in Schofield, WI. 


On April 10, a gunman fatally shot two and injured one at 
an elementary school in San Bernardino, CA. 


On April 13, a gunman fatally shot one and injured three on 
a commuter train in Atlanta, GA. 


On April 18, a gunman engaged in a shooting spree, killing 
three in downtown Fresno, CA. 


On April 30, a gunman opened fire on random people in the 
pool area of an apartment complex in San Diego, CA, killing 
one and injuring seven. 


On May 1, a man fatally stabbed one and injured three ona 
university campus in Austin, TX. 


On May 12, a gunman fatally shot three inside a nursing 
home in Kirkersville, OH. 


On May 18, a man injured 22 when he drove his car into 
pedestrians on a sidewalk near Times Square in New York, 
NY. 


On May 26, a man fatally stabbed two and injured a third 
on a MAX Light Rail train in Portland, OR. 


On June 5, a gunman fatally shot five in a manufacturing 
facility in Orlando, FL. 


On June 8, a gunman fatally shot three in a supermarket in 
Tunkhannock, PA. 


15) 


16) 


17) 


18) 


19) 


20) 


21) 


22) 


23) 


24) 


25) 


26) 


21) 


28) 


On June 14, a gunman wounded five at a Republican 
Congressional baseball practice in Alexandria, VA. 


On June 14, a gunman fatally shot three and injured two in 
a warehouse facility in San Francisco, CA. 


On June 30, a gunman fatally shot one and injured six inside 
a hospital in Bronx, NY. 


On August 12, a man killed one and injured 19 when he 
drove his car into a crowd at a rally in Charlottesville, VA. 


On August 28, a gunman fatally shot two and injured four in 
a library in Clovis, NM. 


On September 13, a gunman fatally shot one and injured 
three at a high school in Rockford, WA. 


On September 24, a gunman fatally shot one and injured 
seven at a church in Antioch, TN. 


On October 1, a gunman opened fire on the crowd at a 
music festival in Las Vegas, NV, killing 58 and wounding 546. 


On October 18, a gunman fatally shot three and injured two 
in Edgewood, MD. Nearly two hours later, he shot and 
injured one at an auto dealership in Wilmington, DE. 


On October 31, a man drove onto the bike and pedestrian 
path in New York, NY, killing 8 and injuring 12. 


On November 1, a gunman fatally shot three inside a 
Walmart in Thornton, CO. 


On November 4, a gunman opened fire on or near 
Interstate-35 in Austin, TX, injuring four. 


On November 5, a gunman fatally shot 26 and injured 20 at 
a church in Sutherland Springs, TX. 


On November 14, after killing his wife, a gunman shot his 
neighbors. He then fired randomly at others as he moved 
through town, and at an elementary school in Corning, CA. 
All told, he shot and wounded at least 10 and killed five, 
including two of his neighbors and his wife. 


1 The incidents included in this report were identified and researched through open source reporting (e.g., media sources and law enforcement records); 
therefore, it is possible that more took place than were discovered at the time of this writing. Though there is much debate as to what defines a mass attack, 
for the purpose of this report we included acts of intentional violence in public (e.g., parks, community events, retail establishments) or semi-public (e.g., 
workplaces, schools, religious establishments) places during which significant harm was caused to three or more persons. We excluded violence related to 
criminal acts (e.g., gang or drug activity), failed attempts at a mass attack, or spontaneous group violence. Outside of the incidents included in this report, 
six other incidents took place in 2017 that were noteworthy due to their indiscriminate or public nature, including attacks at three transportation hubs, a 
car dealership, a high school, and a condominium. Despite the actions and intent of the attackers, these incidents were not included in this report as they 
did not result in significant harm to three or more persons. 
* Those harmed during the attack in Las Vegas were estimated to be 58 killed and 546 injured. In reporting the total injuries and deaths, persons harmed 
by an attacker just prior to the mass attack were included in the total harm caused; however, any harm to the attackers themselves was not. 

3 This report was prepared for educational and research purposes. The background and behaviors reported herein are of those individuals who: 1) were 
arrested for the act; 2) died at the scene; or 3) died immediately following the attack. Actions attributed to individuals who have been arrested, indicted, 
or charged in these incidents are merely allegations, and all are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.” 

4 Additional information on the U.S. Secret Service threat assessment and publications from the National Threat Assessment Center are available on the 


agency’s website, located at https: 


www.secretservice.gov 


rotection/ntac/. 


° Though drug use is one of the disqualifying factors, it was not considered in this review as information was not available to confirm active use within one 
year of the incident. 
© Domestic violence was defined as physical force or the threat of bodily harm inflicted on a romantic partner, parent/guardian, or child (of the assailant or 
romantic partner). If an attacker had a history of domestic violence against a parent or child, the perpetrator and the victim resided at the same location. 
7 This analysis was executed on 26 of the 28 incidents. Two incidents with significantly more casualties were excluded so as not to skew the data. 
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